建立 MAG160C 逆向工程交接仓库

2026-08-11 19:08:44 +08:00
commit 8409b27ba3
3135 changed files with 534408 additions and 0 deletions
@@ -0,0 +1,94 @@
+/* Probe: exact layout of the 0x81 stream as seen by our 2-read capture. */
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <windows.h>
+#include <libusb.h>
+
+static libusb_context *g_ctx;
+static libusb_device_handle *g_h;
+
+static int sendcmd(unsigned magic, unsigned param, int len) {
+    unsigned char cmd[8] = {0};
+    cmd[0] = (unsigned char)(magic);
+    cmd[1] = (unsigned char)(magic >> 8);
+    cmd[2] = (unsigned char)(magic >> 16);
+    cmd[3] = (unsigned char)(magic >> 24);
+    if (len >= 8) {
+        cmd[4] = (unsigned char)(param);
+        cmd[5] = (unsigned char)(param >> 8);
+        cmd[6] = (unsigned char)(param >> 16);
+        cmd[7] = (unsigned char)(param >> 24);
+    }
+    int xfer = 0;
+    if (libusb_bulk_transfer(g_h, 0x03, cmd, len, &xfer, 2000)) return -1;
+    unsigned char resp[0x1000];
+    if (libusb_bulk_transfer(g_h, 0x82, resp, sizeof(resp), &xfer, 2000)) return -1;
+    return 0;
+}
+
+int main(void) {
+    libusb_init(&g_ctx);
+    libusb_device **list = NULL;
+    ssize_t cnt = libusb_get_device_list(g_ctx, &list);
+    for (ssize_t i = 0; i < cnt && !g_h; ++i) {
+        struct libusb_device_descriptor d;
+        libusb_get_device_descriptor(list[i], &d);
+        if (d.idVendor == 0x833c) libusb_open(list[i], &g_h);
+    }
+    libusb_free_device_list(list, 1);
+    if (!g_h) { printf("no device\n"); return 1; }
+    libusb_set_configuration(g_h, 2);
+    libusb_set_configuration(g_h, 1);
+    if (libusb_claim_interface(g_h, 0)) return 1;
+    sendcmd(0x6bb6b66b, 0, 4);
+    sendcmd(0x6bb6b66c, 0, 4);
+    sendcmd(0x6bb6b66f, 0, 4);
+    sendcmd(0x6bb6b672, 0, 8);
+    Sleep(100);
+    sendcmd(0x6bb6b672, 0, 8);
+    Sleep(300);
+    sendcmd(0x6bb6b673, 0, 4);
+    Sleep(700);
+
+    for (int n = 0; n < 8; ++n) {
+        unsigned char hdr[64];
+        int xfer = 0;
+        if (libusb_bulk_transfer(g_h, 0x81, hdr, sizeof(hdr), &xfer, 200) || xfer < 28) { Sleep(10); continue; }
+        unsigned m = (unsigned)hdr[0] | ((unsigned)hdr[1] << 8) |
+                     ((unsigned)hdr[2] << 16) | ((unsigned)hdr[3] << 24);
+        if (m != 0x1bb1b11b) { printf("read1: no magic (m=%08x, xfer=%d)\n", m, xfer); continue; }
+        printf("read1: xfer=%d magic ok type=%u len=%u\n", xfer, hdr[12],
+               (unsigned)hdr[8] | ((unsigned)hdr[9] << 8) | ((unsigned)hdr[10] << 16) | ((unsigned)hdr[11] << 24));
+        unsigned char buf[40000];
+        if (libusb_bulk_transfer(g_h, 0x81, buf, sizeof(buf), &xfer, 200)) { printf("read2 fail\n"); continue; }
+        printf("read2: xfer=%d\n", xfer);
+        printf("  buf[0..15] hex: ");
+        for (int i = 0; i < 16; ++i) printf("%02x ", buf[i]);
+        printf("\n");
+        /* search for trailer magic 1bb1b11c */
+        int found = -1;
+        for (int i = 0; i + 4 <= xfer; ++i) {
+            unsigned v = (unsigned)buf[i] | ((unsigned)buf[i+1] << 8) |
+                         ((unsigned)buf[i+2] << 16) | ((unsigned)buf[i+3] << 24);
+            if (v == 0x1bb1b11c) { found = i; break; }
+        }
+        printf("  trailer 1bb1b11c at buf+%d (xfer=%d)\n", found, xfer);
+        printf("  buf[found+4..found+11]: ");
+        for (int i = 0; i < 8 && found + 4 + i < xfer; ++i) printf("%02x ", buf[found + 4 + i]);
+        printf("\n");
+        /* dump u16 pixel candidates at 0 and 28 */
+        unsigned p0 = buf[0] | (buf[1] << 8);
+        unsigned p28 = buf[28] | (buf[29] << 8);
+        printf("  u16@0=%u u16@28=%u (background ~9500-11000)\n", p0, p28);
+        return 0;
+    }
+    printf("no frame seen\n");
+    Sleep(300);
+    libusb_clear_halt(g_h, 0x03);
+    libusb_clear_halt(g_h, 0x82);
+    sendcmd(0x6bb6b674, 0, 4);
+    libusb_close(g_h);
+    libusb_exit(g_ctx);
+    return 0;
+}